This page describes what information Draftlab collects about the people we work with, how it’s stored and managed, and how we protect it. We commit to keeping this statement readable and accessible to humans.

Draftlab B.V. is based in The Hague, the Netherlands, and is the controller of the data described here. Questions, requests and complaints go to hello@draftlab.org.

  • Revision: October 2026

We collect as little as possible

We work with civil society organisations, humanitarian actors and activists, many of whom are at-risk and operate under threat. This means that any information we hold about them can put them at risk if accessed by third parties without their consent. For that reason, we only collect and store information that is absolutely necessary for the work we are doing, and advise our partners on data minimization approaches.

We do not sell, trade, rent or give away your data

Nobody outside Draftlab and project-scoped contractors gets access to information about our partners, collaborators, research participants or website visitors. We do not buy or sell lists; we do not sign data-sharing agreements with other organisations; and we do not send newsletters or marketing of any kind.

We follow your threat model

Our choice of trusted providers might not be yours. We are happy to adapt to your security and privacy requirements. Please go over the list of providers we use and let us know which ones do not work with your threat model. We will find the appropriate solution together, like secure comms via Signal or PGP, self-hosted infrastructure for documents, etc.

Our website

draftlab.org is a static site hosted on Netlify. Netlify processes standard server logs (IP address, user agent, requested page) to serve the site; see Netlify's privacy policy. The site's source code lives on GitHub.

Analytics. We run our own instance of Umami for site analytics. Umami does not use cookies, does not store IP addresses, and does not identify individual visitors. The data stays on our own server.

Contact forms. Forms on the site are delivered through Brevo, which we use for delivery only. What you type into a form, along with your name and email address, passes through Brevo and lands in our inbox. Brevo is a French company; see Brevo's privacy policy.

Scheduling. If you book a call with us you do so through cal.com, which stores your name, email address and the booking details, and writes the event to our Google Calendar. See cal.com's privacy policy. If you prefer, you can contact us directly at hello@draftlab.org.

The tools we work with every day

We keep this list current so you are aware of our stack, and can choose your level of comfort and acceptance.

Google Workspace (enterprise). Email, calendar, documents and file storage. We have set data storage to EU regions.

Claude (enterprise). Our AI assistant of choice, under an enterprise agreement that excludes our input from model training. How we use it is defined by our AI policy.

GitHub. Code, issues and documentation for our projects.

Self-hosted services. We run the following ourselves on EU-based servers at Greenhost and Hetzner. We manage our servers ourselves.

  • Umami for website analytics
  • Formbricks for surveys and feedback forms
  • HedgeDoc for collaborative note-taking
  • Metabase for dashboards and analysis in partner projects

Working with and for Draftlab

Applications, CVs and correspondence from candidates are seen only by the people involved in hiring. We do not ask for background checks or special category data. When someone joins, we collect what is needed for Dutch tax and contracting purposes and nothing more.

Keeping data secure

Draftlab has trained civil society organisations on digital security for over a decade. We hold ourselves to the same standard we teach. We have read the privacy policies and security documentation of the platforms we use, and we do our best to revisit this list periodically.

Data breaches

If we discover a breach involving personal data, we notify the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) within 72 hours as required by the GDPR, and we inform the people affected directly.

Data outside the EEA

Our own infrastructure is in the EU. Some of the providers above (Google, Anthropic, GitHub, Netlify, cal.com) are American companies. Where we use them we rely on their data processing agreements and the EU-US Data Privacy Framework or standard contractual clauses. Where that is not good enough for your situation, see "We follow your threat model" above.

Your rights and getting in touch

Under the GDPR you have the right to:

To exercise any of these rights, email hello@draftlab.org.  If you are not satisfied with our response you can file a complaint with the Autoriteit Persoonsgegevens, the Dutch data protection authority.

Acknowledgements

We thank Ura Design and Superbloom for their policies, which this statement borrows from freely.